I'm reading that the same, but in this case it's a performance consideration; most systems expected to use AES-GCM-SIV use little-endian order internally, and s

I'm reading that the same, but in this case it's a performance consideration; most systems expected to use AES-GCM-SIV use little-endian order internally, and since AES is often implemented at extremely low level (including in hardware), for most real-world systems (in particular, ones where crypto is extremely performance-sensitive), it doesn't make sense to impose an extra byte reordering for a value that is only used by the encryption process itself.